Screenshot APIs all send your page content to their servers — built a self-hosted one, looking for feedback

Description and use

SaaS screenshot APIs send page content to third parties. The author built a local service to keep data in the user’s network, but it lacks a security audit and cannot capture private IPs yet.

Problem

SaaS screenshot APIs send captured page text to third‑party servers, exposing sensitive data behind logins.

Outcome

The self‑hosted service keeps page content on the local machine, but lacks a security audit, has moderate extraction quality, and cannot yet capture private‑IP hosts due to SSRF guard.

Workflow

• 1. Identify need for private screenshot capture.
• 2. Search for self‑hostable screenshot solutions; none found.
• 3. Build a Docker‑Compose based service (shotbase).
• 4. Configure extraction to use a local model (e.g., Ollama).
• 5. Deploy and test against hosted APIs.
• 6. Gather feedback on usability and performance.

Evidence

Every screenshot API is SaaS, which is fine, until you notice the page-understanding part runs on their model. So the text of every page you capture gets sent to a third party and processed there.

Source

Runs with docker compose. The extraction part runs on whatever model you point at it — including Ollama on localhost, in which case the page text never leaves the machine that rendered it.

Source

Honest about where it's weak: no security audit, extraction quality is decent not amazing, and you can't capture your own private-IP hosts yet because the SSRF guard blocks RFC1918 with no opt-out (allowlist is the next thing I'm building).

Source